[New Integration] Iru (formerly Kandji)

## 1. Summary
Collect audit events and device inventory from Iru (formerly Kandji) into Elastic Security. Iru is an Apple-first device management platform (now expanding to Windows and Android); this integration brings its console audit log and managed-device inventory into Elastic — for tracking administrative activity and configuration changes, and for device and asset entity context.

## 2. Vendor and product
Iru manages a fleet of devices and their configuration. Its REST API exposes an audit log of account activity and a full inventory of managed devices.

- **Transport:** the Iru REST API. The integration polls on a schedule; nothing needs to be opened inbound.
- **Auth:** a Bearer API token created in the Iru console, granted the audit and device read permissions.
- **Deployment:** built on CEL as an API pull, so it can run agentless. The customer's subdomain and region (US/EU) are config options; both the `iru.com` and legacy `kandji.io` API hosts are supported.

## 3. Data
Two typed data streams:

- **Audit events** — console and account activity: blueprint and configuration changes, sensitive-data access (such as recovery keys), device lifecycle (enrollment, removal, blueprint changes), directory-user events, and admin actions including API token management. Each record carries the action, the actor, the target, and a timestamp.
- **Device inventory** — managed devices with platform, model, OS version, enrollment and agent status, last check-in, assigned user, blueprint, and tags. Strong device and asset entity context. This stream should map to the host and asset entity fields so it works with Elastic Entity Analytics — the device identifiers (hostname, serial, device ID) and assigned user need to land on the fields the entity store keys on, so Iru devices merge with the same hosts seen elsewhere rather than creating separate entities.

## 4. What we get
Iru admin activity and device inventory in Elastic, mapped to ECS and joinable to the same devices and users across a customer's other data. Audit events give visibility into who changed the device-management configuration, who accessed sensitive keys, and how the fleet's enrollment changed over time — useful for detecting risky admin activity and for compliance. Device inventory feeds host and asset entity context, and surfaces stale or non-reporting devices. Comes with dashboards for both.

## 5. Dashboards
An audit activity overview:
- activity over time by action and actor
- configuration and blueprint changes
- sensitive-data access (recovery keys) and device lifecycle events
- API token and admin changes
- a recent-activity table for review

A device inventory view:
- fleet by platform, model, and OS version
- enrollment and agent status
- stale or non-reporting devices by last check-in
- devices by blueprint and assigned user

## 6. References
- [Iru Endpoint Management API](https://api-docs.iru.com/)
- [Iru API tokens](https://support.kandji.io/api)